Experiencing a Security Breach?

24 Hour Hotline: +1 (866) 659-9097 Option 5

General

+1 (312) 873-7500

Monday - Friday 8:00 AM - 6:00 PM CT (UTC -6)

Sales

Contact a Trustwave solution specialist.

+1 (888) 878-7817

Monday - Friday 8:30 AM - 5:30 PM CT (UTC -6)

Loading...

Blogs & Stories

SpiderLabs Blog

Attracting more than a half-million annual readers, this is the security community's go-to destination for technical breakdowns of the latest threats, critical vulnerability disclosures and cutting-edge research.

Cuckoo for Cuckoo Box

Cuckoo Sandbox is an automated, open source, malware analysis system that started as a Google Summer of Code project in 2010 and recently released version 0.3 in December of 2011. I am a big fan of the project, and I am excited to see what they have up their sleeves for subsequent releases. The ability to create customized analysis packages and to extend existing code to fit unique use cases couldn't be easier. Documentation exists and is actually helpful.

Now that I've sung the Cuckoo praise song, I wanted to pass along a bit of help to anyone who wants to get it running on Mac OS X. Now to be fair the documentation recommends a GNU/Linux setup, preferably Ubuntu. So while Mac isn't the first choice, you can definitely get it up and running with minimal effort.

Specifically the issue I ran into came when I was installing two of the required Python libraries: python-magic and pyssdeep. Even if you don't have these libraries installed at all, everything will still run, but you will miss out on file type info and fuzzy hashing goodness in your analysis reports. After installing both libraries I still wasn't getting the output I was expecting. I dug around and discovered that there are multiple versions of both of these libraries and the interfaces to them are not identical. How unfortunate. So, to keep a long story short, I modified the code of file.py located at cuckoo/cuckoo/processing/file.py starting on line 109 to the following (my additions in red):